[AMD Official Use Only] >-----Original Message----- >From: Lazar, Lijo <Lijo.Lazar@xxxxxxx> >Sent: Wednesday, October 13, 2021 4:07 PM >To: Yu, Lang <Lang.Yu@xxxxxxx>; amd-gfx@xxxxxxxxxxxxxxxxxxxxx; Kuehling, >Felix <Felix.Kuehling@xxxxxxx> >Cc: Deucher, Alexander <Alexander.Deucher@xxxxxxx>; Huang, Ray ><Ray.Huang@xxxxxxx> >Subject: Re: [PATCH] drm/amdkfd: Fix a __user pointer dereference in >create_signal_event > > > >On 10/13/2021 1:03 PM, Lang Yu wrote: >> We should not dereference __user pointers directly. >> https://yarchive.net/comp/linux/user_pointers.html >> >> Fixes: 482f07775cf5 >> ("drm/amdkfd: Simplify event ID and signal slot management") >> >> Signed-off-by: Lang Yu <lang.yu@xxxxxxx> >> --- >> drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c >> b/drivers/gpu/drm/amd/amdkfd/kfd_events.c >> index 3eea4edee355..74d3bdcfe341 100644 >> --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c >> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c >> @@ -201,7 +201,7 @@ static int create_signal_event(struct file >> *devkfd, >> >> p->signal_event_count++; >> >> - ev->user_signal_address = &p->signal_page->user_address[ev- >>event_id]; > >This is interesting. I thought this wouldn't dereference. > >See here - > >https://en.cppreference.com/w/c/language/operator_member_access > >"If the operand is an array index expression, no action is taken other than the >array-to-pointer conversion and the addition, so &a[N] is valid for an array of size >N (obtaining a pointer one past the end is okay, dereferencing it is not, but >dereference cancels out in this expression)" Thanks for your clarification about this. I got it. Regards, Lang >Thanks, >Lijo > > >> + ev->user_signal_address = p->signal_page->user_address + >> +ev->event_id; >> pr_debug("Signal event number %zu created with id %d, address %p\n", >> p->signal_event_count, ev->event_id, >> ev->user_signal_address); >>
